Right now, the communication between the browser and the "plugin" server runs over HTTP, which is OK because it is local. However, all the "network" communication should happen by using a token. This token should be generated everytime the server is started and should be destroyed after the server is closed. The "/get-token" should also return this token to the JavaScript. 

Alternate (and possibly preferred method):

We can use the gitlab_private_token which is returned to JS using `/get-token` method.  This token is sent as "PRIVATE-TOKEN: token" as header in all requests. We should check all incoming requests in the fastapi server that they contain this PRIVATE-TOKEN as the header.